feat(studio): friendlyError catches hub-specific patterns

Generic gRPC-code mapping was right but not specific enough.
A flow failing with an approval-timeout used to land on
'Deadline exceeded — try again later'; now it reads 'Freigabe-
Timeout abgelaufen — entweder timeout_seconds erhöhen oder
den Reviewer informieren.'

New pattern matchers in _matchHubPattern, runs before the
gRPC-code switch. Six FlowExecutionError shapes covered:

  - approval rejected ("rejected by")
  - approval timeout
  - output too large ("exceeding the X MB cap")
  - host service not declared
  - missing value reference
  - MCP endpoint unreachable
  - capability not installed (NotFound fallback)

Every match comes with a localised hint pointing at the
concrete fix path (audit log / timeout config / Integrations
panel / Text-tab Fix button).

Five new tests pin the matchers — would catch a silent
regression when the hub renames a variant Display string.
All 11 friendly_error tests + 19 Studio tests green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/friendly_error.dart

@@ -39,6 +39,12 @@ FriendlyError friendlyError(Object error, AppLocalizations l) {
   // duck-type on those instead of an `is` check.
   final code = _intField(error, 'code');
   final detail = _stringField(error, 'message') ?? '';
+  // Hub-specific pattern detection — runs BEFORE the gRPC-code
+  // switch so a precise hit ("approval rejected by ...") wins
+  // over the generic "permission denied" label even though
+  // both correspond to gRPC PERMISSION_DENIED.
+  final specific = _matchHubPattern(detail, l);
+  if (specific != null) return specific;
   if (code != null) {
     switch (code) {
       case 3: // INVALID_ARGUMENT
@@ -107,6 +113,82 @@ FriendlyError friendlyError(Object error, AppLocalizations l) {
   );
 }
 
+/// Pattern-match the gRPC error message for hub-specific
+/// failure shapes. The hub's [FlowExecutionError] uses
+/// well-shaped Display formats (e.g.
+/// `step 'ap1' rejected by alice: ...`) — we read the prefix
+/// to return a more specific [FriendlyError] than the
+/// gRPC-code default. Returns null when nothing matches.
+FriendlyError? _matchHubPattern(String detail, AppLocalizations l) {
+  if (detail.isEmpty) return null;
+
+  // Approval rejected: "step 'X' rejected by Y: reason"
+  if (detail.contains('rejected by')) {
+    return FriendlyError(
+      headline: l.errApprovalRejected,
+      detail: detail,
+      hint: l.errApprovalRejectedHint,
+    );
+  }
+  // Approval timeout: "step 'X' timed out waiting for approval after Ns"
+  if (detail.contains('timed out waiting for approval')) {
+    return FriendlyError(
+      headline: l.errApprovalTimedOut,
+      detail: detail,
+      hint: l.errApprovalTimedOutHint,
+    );
+  }
+  // Output too large: "step 'X' produced N bytes of output, exceeding the M MB cap"
+  if (detail.contains('exceeding the') &&
+      detail.contains('MB cap')) {
+    return FriendlyError(
+      headline: l.errOutputTooLarge,
+      detail: detail,
+      hint: l.errOutputTooLargeHint,
+    );
+  }
+  // Host service unavailable: "step 'X' requires service 'Y' which is not declared"
+  if (detail.contains('requires service') &&
+      detail.contains('not declared')) {
+    return FriendlyError(
+      headline: l.errServiceUnavailableForStep,
+      detail: detail,
+      hint: l.errServiceUnavailableForStepHint,
+    );
+  }
+  // Missing value: "step 'X' references missing value 'Y'"
+  if (detail.contains('references missing value')) {
+    return FriendlyError(
+      headline: l.errMissingValue,
+      detail: detail,
+      hint: l.errMissingValueHint,
+    );
+  }
+  // MCP server unreachable — hub surfaces these as Unavailable
+  // with the MCP transport name in the message.
+  if (detail.toLowerCase().contains('mcp') &&
+      (detail.contains('unreachable') ||
+          detail.contains('connection refused') ||
+          detail.contains('timed out'))) {
+    return FriendlyError(
+      headline: l.errMcpUnreachable,
+      detail: detail,
+      hint: l.errMcpUnreachableHint,
+    );
+  }
+  // Capability not in registry — hub returns NotFound with this
+  // shape from the flow engine.
+  if (detail.toLowerCase().contains('no capability provider') ||
+      detail.toLowerCase().contains('capability not installed')) {
+    return FriendlyError(
+      headline: l.errCapabilityNotInstalled,
+      detail: detail,
+      hint: l.errCapabilityNotInstalledHint,
+    );
+  }
+  return null;
+}
+
 /// Try to read an `int` field by name off an arbitrary object.
 /// Returns `null` when the field doesn't exist or has another
 /// runtime type. Used to duck-type `GrpcError.code` without